October 4, 2026 When Even Epic Hits Pause: A Health-Records Giant Froze Development to Fix Security Bugs. What That Says About Your Dental Software Vendor.
In early October 2026, the largest medical-records company in the United States did something almost unheard of: it stopped building. Epic Systems — the maker of MyChart and the software that stores the health records of an enormous share of American patients — announced it was pausing most of its product development to focus on fixing security flaws that could have given attackers hidden access to patient data. Chief executive Judy Faulkner told the healthcare press the company would spend the coming weeks on security, not features.
What makes the story remarkable is not that a software company had bugs. Every piece of software has them. It is that a vendor with Epic’s resources judged the risk serious enough to freeze its entire roadmap. For a dental practice, that is worth sitting with for a moment — because your practice runs on software from a vendor too, and you almost certainly know far less about their security than you assume.
What actually happened at Epic
According to reporting from The New York Times and TechCrunch, Epic used an artificial-intelligence tool to review its own codebase and found security weaknesses that could have let an intruder reach patient health information without being detected. Rather than quietly patching them over time, the company paused most new development so its engineers could concentrate on closing the holes. There is no indication that patient data was actually stolen; this was Epic getting ahead of a problem it discovered itself.
There are two lessons tucked inside that. The first is reassuring: a serious vendor, when it finds a serious flaw, drops everything to fix it. The second is sobering: the same AI-assisted techniques Epic used to find its flaws are available to attackers, who are increasingly using automation to hunt for exactly these weaknesses in widely deployed software. The clock on undiscovered bugs is getting shorter for everyone.
Your practice-management system is your Epic
A dental office does not run Epic, but it runs something that plays the same role. Dentrix, Eaglesoft, Open Dental, Curve, tab32 — whatever sits at your front desk is the system your entire day flows through, and the single largest concentration of protected health information you hold. Appointment histories, treatment notes, insurance details, imaging, payment data: it all lives in or behind that software.
That means your practice has quietly inherited your vendor’s security decisions. If they write careless code, you carry the risk. If they are slow to patch, your patients’ records sit exposed while you wait. This is not hypothetical for dentistry — we have seen how a flaw in the software layer becomes a direct path to patient data, as in the way a SQL injection bug in practice-management software can expose an entire database. When the software is the weak point, no amount of good behavior at the front desk fully protects you.
The questions you are entitled to ask
You cannot read your vendor’s source code, and you should not try. But you are the customer, and you are allowed to ask how they handle security — the same way regulators are starting to demand of device makers. In fact, the FDA now requires imaging-device makers to build security in by design, which gives you a ready template for the questions worth putting to any software vendor:
- How quickly do you patch, and how are we notified? Ask for their track record on security updates and how they communicate them. A vendor that cannot answer plainly is telling you something.
- Do you test your own code for security flaws? Independent security testing, or the kind of proactive code review Epic just performed, separates serious vendors from the rest.
- Will you sign a business associate agreement, and what does it commit you to? Under PHIPA and HIPAA, your software vendor handles protected health information on your behalf. The agreement should spell out their obligations if something goes wrong.
- How is our data encrypted, and who can reach it? Both where it sits and while it moves — and whether the vendor’s own staff can see it.
- What is your breach-notification commitment? If their systems are compromised, how fast and how clearly will they tell you, so you can meet your own reporting duties?
These are not adversarial questions. A confident vendor welcomes them, and the exercise itself tells you whether security is part of their culture or an afterthought. The same instinct is driving regulation: proposals like mandatory healthcare cybersecurity standards under HISAA would eventually push accountability down the whole software supply chain, dental practices included.
What stays firmly in your hands
Vendor risk is real, but it is not the whole story — and dwelling on what you cannot control misses the controls you fully own. A flaw in your software vendor only becomes a catastrophe if your own defenses let it spread.
- Apply updates promptly. The most common breaches exploit flaws the vendor already fixed. When your PMS or operating-system vendor ships a security update, installing it quickly is the single highest-value thing you do.
- Segment the network. Your practice-management server should not be reachable from the guest Wi-Fi or a compromised front-desk browser. Limiting what can talk to your database limits what any one weakness can reach.
- Keep tested, isolated backups. If a vendor flaw or ransomware corrupts your database, a backup you have actually restored from is what gets you open the next morning.
- Lock down the accounts. Most intrusions still ride in on a stolen or weak login. As one compromised account exposing tens of thousands of dental patients showed, strong, phishing-resistant sign-in on every account that touches patient data is the weak link you most directly control.
The real takeaway
Epic pausing its roadmap is, oddly, good news — it is what responsible stewardship of patient data looks like. The uncomfortable part is the question it raises for everyone else: would my software vendor do the same, and would I even hear about it? If you do not know how the company behind your practice-management system handles security, that uncertainty is itself a risk you are carrying on behalf of every patient in your database.
How Compudent Systems can help
At Compudent Systems, we help dental practices across the GTA and Ontario turn vendor uncertainty into a plan — reviewing the security posture of your practice-management and imaging software, putting the right questions to your vendors, confirming your business associate agreements actually cover you, and hardening the parts you control: prompt patching, network segmentation, tested backups, and strong account protection. You cannot audit your vendor’s code, but you do not have to depend on hope either. Contact Compudent Systems for a software and data-security assessment, and let us make sure a flaw in someone else’s software never becomes a breach in your practice.
Sources & further reading:
- Medical records giant Epic pauses product development to fix security bugs that risk patients’ data
- Medical Records Firm Uses AI Tool to Expose Flaws that Threaten Patient Privacy
Related Reading
- No Malware Required: How an "IDOR" Flaw in Dental Software Exposed Patient Records — and the Questions to Ask Your Vendor
- Critical Weaver E-cology CVE-2026-22679 Vulnerability: Urgent Security Alert for Dental Practices Using Enterprise Collaboration Platforms
- The Breach Vector Hiding in Your Practice Management Software: SQL Injection Explained for Dental Offices